Its goal is to make it easier for people, especially marginalized groups (including LGBT persons), to protect their privacy and anonymity online by helping app and technology firms more easily build privacy-by-default services via open source software that they’re spearheading.

We asked Sarah a few questions about the Open Privacy Research Society and the state of privacy in tech in general, and have reprinted her responses in full below.

What was the impetus for this project?

Last year I published a book, Queer Privacy, it’s a collection of essays written by people in queer and trans communities. While all the essays were ostensibly about technology, they cover broad topics like coming out, dating, sex work, intimate partner violence and even death and media representation.

It was a hard project to work on, but my goal was to finally start documenting how modern technology fails to protect the privacy, or uphold the consent of, marginalized people.

I’m not a fan of simply documenting though, and it’s no coincidence that Open Privacy emerged roughly a year after I finished the first cut of Queer Privacy.

I have had a year to sit and think about the kinds of technology we need to build, as well as the kind of organization we need to ensure that technology exists. And I’ve also had a year to find some amazing people to work with me and help guide that.

Can you give some examples of things that you saw and why they were problematic?

Real name policies are one example, forced account correlation is another, e.g. it is common for LGBT people in certain parts of the world to have two Facebook accounts: a regular one for family and work, and an “out” one which they use for dating/meeting other LGBT people.

These people have to go through a lot of effort to make sure that those accounts stay separate/unidentifiable, with one of the major risks being their “out” account showing up on a “people you may know” sidebar for one of their family members, and thus potentially outing them.

We have recently seen issues even in LGBT focused apps like Grindr, sharing location data insecurely or HIV status with third party platforms. This kind of non-consensual data sharing is something that should be impossible.

A key phrase in the Open Privacy Research Society mission statement is “We believe that moral systems enable consent.” Can you elaborate a bit on this?

We believe that it is possible to use technology to protect fundamental human rights. It is not just enough to give people the building blocks e.g. encryption – we need to build systems that actively help them achieve their goals and protect them from harm.

We define moral systems as those that protect people by default and are built to withstand abuse by those with malicious intent. We believe in systems that distribute power and resist attempts to centralize it.

Our priorities right now are on making metadata resistant communication platforms usable. We have good tools for protecting the content of communications, but we believe we can do better.

Technology shouldn’t be able to collect information on who someone is talking to, when they [are talking], where they are talking from etc. This kind of communications metadata is pervasive and enables corporations and governments to build surveillance and censorship systems.

We are working on an open protocol (Cwtch) that makes that kind of metadata collection impossible and allows us and others to build messaging apps, discussion forums, advertising boards or any other imaginable application in a way that is privacy-preserving in the truest sense of the word.

Cwtch is based on Ricochet which uses Tor onion services to provide peer-to-peer instant messaging without third parties. There is no one in a position to take data without consent because the only data shared is between you and the person you are talking with. Everything is as private as can be and metadata is kept as small as technically possible.

We’ve been working on a way to extend this concept to groups (which will be version 1 of Cwtch), and then eventually to higher level applications. The idea being that the data is controlled by you, and the only time you give it away is either directly to another person you trust or via privacy-preserving structures that only you and other people you trust have access to.

Why has so much of our tech failed to protect marginalized communities?

Quite frankly it’s because catering to the protection of marginalized communities is not aligned with the incentives of modern surveillance capitalism. There are countless examples of social networks, messaging apps, and other tools placing marginalized people at risk through simple ignorance.

What should organizations do to build better tools and privacy controls for all their users?

I think we have to give people tools and involve them in the research necessary to produce those tools. Too often we have produced technically brilliant tools that are unusable by those with limited time to devote to learning them. We have entire movements centered around training people how to use these tools, that is unsustainable.

“Nothing about us, without us” isn’t just a catchy saying, it is a reminder that when we build technology we must involve as many voices as possible, from as many communities as possible. Only with those voices can we hope to build technology that protects the most vulnerable and the most marginalized.

Your career began in the context of government work and at a large corporation (Amazon), both of which are known for tracking citizens/consumers. What is it that caused you to not just walk away from that kind of work but choose to fight against it?

I believe that when you make a mistake, regardless of your intent, you must work to undo the damage you have caused. I helped build surveillance systems when I was early in my career. It is something I regret doing, and I think the only way to reduce the harm done by those actions it to build new systems and structures that resist censorship and surveillance. Systems and structures that enable consent. That’s what Open Privacy is and will be.

3 comments on “Interview: Sarah Jamie Lewis, Executive Director of the Open Privacy Research Society”

The type of system they are talking about building is also one that would protect you from the consequences of your actions. Cyber bullying with no attribution? Terrorist COMMO that can’t be detected? No thanks…. This could all be avoided if people were more interested in being honest and noble, then secretive and manipulative.

What did you say? you can’t really think that, can you? Are you really trying to say that if i don’t want the hole world to know my personal business I’m somehow being manipulative? i just don’t get it.

Trust me I’m a very private person, i don’t like any of my information out there, i don’t even like giving my government issued ID number when applying for a job, but i have to.

The truth is this, large corporations do everything in there power to collect as much information on us as possible, its now a main part of there business model. If you are like me, and think its none of Amazon’s business how many kinds i have, what kind of car i drive, sexual orientation i am, what blood type i have, how often i have sex with my wife, ext. then you would know that your comment is a joke.

Wake up before its to late and all your privacy is gone. and furthermore, its not just Amazon, its Intel, Walmart, Facebook, Twitter, Mobil. The list can literally go on for pages. More people need to tell these company’s that they have no rite to collect this information on us, and i fear it will never happen.

As far as Terrorist being able to speak in private, get over it! law enforcement has a hard job, a very hard job. This is why we give them so much power, but if you think that they won’t find or make there own software that can’t be broken if we take away there tools now, you are mistaken. Its this kind of mentality that really gets to me. Here is an Idea Mike, why don’t you make a spare key to your house and car and give them to your local law enforcement? Certainly no cop ever would ever misuse this power you give them, and who know one day there may be a need for the cops to get into your house in a rush.